ASD ISM 2152Segregate Backup Infrastructure With Separate Administrative Authentication

Plain language

Backups are the thing you fall back on when production is lost, so they must not fall at the same time production does. This control has two parts. First, the backup infrastructure (the backup servers, the repositories where backup data is stored, and the management consoles used to run the backup system) is kept segregated from the production environment rather than sitting on the same network segments and hosts as the systems it protects. Second, administrative access to that backup infrastructure uses a separate authentication mechanism, so the credentials and identity system that grant production administrator rights do not also grant backup administrator rights. The real-world risk is straightforward. Ransomware operators and intruders who gain a production domain administrator account routinely go looking for the backups first, because deleting or encrypting them removes the organisation's ability to recover without paying. If the backup console trusts the same directory as production and the backup repository is reachable from any production server, one compromised administrator account is enough to destroy both the live data and every copy of it. Segregation limits what an attacker inside production can reach, and separate authentication means the credentials they already hold do not open the backup system.